DVA-C02 Security Practice Question
A developer needs to grant an IAM user in the same AWS account access to a specific object in an S3 bucket. The bucket policy currently grants access only to the bucket owner (the root account). Which identity-based policy statement should the developer add to the IAM user's permissions?
⚠ Common exam trap
A common mix-up: candidates confuse resource-based policies (bucket policies) with identity-based policies (IAM policies) and assume that a bucket policy is the only way to grant S3 access, overlooking that IAM policies can grant access to specific objects even when the bucket policy restricts access to the root account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An IAM policy that allows s3:GetObject for the specific object ARN.
An IAM policy attached directly to the user can grant s3:GetObject permission for a specific object ARN (e.g., arn:aws:s3:::bucket-name/object-key). This identity-based policy overrides the bucket policy's default deny for the root-only access, as long as there is no explicit deny in the bucket policy. The bucket policy restricts access to the root account, but an explicit allow in an IAM policy can still grant access to the user since IAM policies and bucket policies are evaluated together, and an explicit allow in either can permit the action unless an explicit deny exists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A bucket policy that allows s3:GetObject for the user.
Why it's wrong here
A bucket policy is a resource-based policy attached directly to an S3 bucket, defining who can access the bucket and its objects. While it *could* be configured to grant s3:GetObject permission to a specific IAM user, the question implies granting access *to* the IAM user, which is typically achieved by modifying the user's own permissions. Relying solely on a bucket policy means the user's access is managed externally to their IAM identity, which can complicate permission auditing from the user's perspective.
- ✓
An IAM policy that allows s3:GetObject for the specific object ARN.
Why this is correct
This is the correct and most direct method for granting an IAM user access to a specific S3 object. An IAM policy is an identity-based policy attached directly to the IAM user (or their group/role), explicitly defining their permissions. By allowing s3:GetObject for the specific object's Amazon Resource Name (ARN), the user is directly granted the necessary permission to retrieve that object's content, provided no explicit deny exists elsewhere.
- ✗
An S3 access point policy.
Why it's wrong here
An S3 Access Point policy is a resource-based policy attached to an S3 Access Point, which acts as a network endpoint for managing access to a bucket. While Access Points can simplify managing access for specific applications or users, they introduce an additional layer of abstraction and require creating a dedicated Access Point. For the straightforward task of granting an existing IAM user direct access to a single specific object, this method is unnecessarily complex and not the most efficient solution.
- ✗
An IAM policy that allows s3:ListBucket for the bucket.
Why it's wrong here
An IAM policy granting s3:ListBucket permission allows an IAM user to view the names of objects within an S3 bucket. However, this permission does not extend to retrieving or reading the actual content of those objects. To access the data stored within a specific S3 object, the s3:GetObject permission is explicitly required. Therefore, s3:ListBucket is insufficient for the stated goal of granting access *to* a specific object's content.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.